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High Level Requirements: LI+DR 

Law Enforcement & National Security Groups Need: 

A solution that allows them access and interrogate data from 
LI and DR. 

Solutions that evolve to cover new and evolving services. 

A capability to configure and focus data for analysis. 

Tools that allow data to be mixed or repackaged as new 
information is identified. 

Effective Development options. 

Secure Solutions. 

Carrier/ISPs Need: 

• Systems that meet National Requirements 

• Solutions that don’t inhibit products 

• Cost effective approach. 
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LI Network Flow Process with Mediation 



Local CSP/ISP Provisioning 



Centralized Provisioning - eg TTP 
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Overview of a DR Solution - CSP/ISP Focus 
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The Objective 

Putting Lawful Interception 
and Data Retention Together 
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LI + DR 



Two Core Partners for an integrated solution: 

- The Carriers/ISP’s 
The Agencies 

Overall Solution must: 

* Have an integrated architecture, CSP to LEA 

* Compatible systems- 

• Defined operating interfaces 

• Defined Processes 

• Effective 

• Secure 

• Agreed roadmaps 
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Roadmaps- Fix Today, Evolve into the Future 

LI or DR solutions do not have to be ‘Big-Bang’. 

Fix Todays Requirement 

Identify Evolution Requirements 

Ensure you have Flexibility and Scalability. 

Objective is to invest in a solution that can grow and 
evolve with the business for both: 

• Carrier 

• LEA 

The ‘business’ on both fronts will change. 
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System Design Must Be Comprehensive 



LI / DR Solution must: 

> Interoperate with multiple telecommunication services and 



> Support vendor-specific network elements. 

Aqsacom approach 



Alarms from equipment and services 

[AQSA 030213] 






Statistics by equipment and services; 
LEA invoicing [AQSA 030413, 030414] 








Enhanced 

HI1 

By service 

[AQSA 050575, 
050577] 
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Enhanced 

HI3 

By service 

[AQSA 050575, 
050577] 


Access & 
Transmission 
Security 
By equipment 

[in progress] 


Fault 

Tolerance 
By equipment 

[AQSA 030008] 


Disaster 
Recovery 
By solution 

[in progress] 


ETSI/3GPP specifications 

[ETSI TS 101 671, TS 102 232, TS 102 233, TS 102 234, 
R 101 944, DTR LI-00014; 3GPP TS 33.108] 









a secure, reliable, and flexible means of telecommunication surveillance that 
will improve the operational efficiencies of investigations 
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ADRIS 

Management 



Building B/ocks-ADRIS Functional Approach 
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Data Storage- Considerations 



Data is being captured and stored for multiple 
purposes: 

Action NOW- Life and Death 
Action Now- Case in progress 
Action now- Active Investigation 
Store- Possible interest 

Store for Future. 
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Storing and Mining Data 



Given these ‘Considerations’: 

Strategic Framework for Data storage: 

• Prioritize/tag data in line with known search profiles. 

• Store high priority data to enable instant and effective 
mining. 

• Store low risk data in a way that balances cost with risk 
assessment. 

Invest in Solutions that achieve the business need- A 
structured approach. 
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Telecommunication Surveillance Solution Architecture 
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Exploitation by LEA: 

• Content consultation and analysis 

• Traffic qualification 

• Service operation 



— Interface D 



Consolidation by LEA: 

• Profiling communication & 
subscribers 

• Request for qualification of 
new traffic 

• Traffic aggregations 




— Interface C 



Storage by Country: 

• Mass storage Device 

• SAN architecture 

• Database Model 




Low Priority 
DRI 



— Interface B 

Mediation by Country : 

• Gathering of all data 

• Pre-filtering process 

• Forwarding in a secure and 
reliable mechanism 




High Priority 
IRI + CC 



ALIS / ADRIS / Roaming Survey / MobileTrack / ... 



— Interface A 



Extraction by Network: 

• Communication signalling 
information 

• Communication content 
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CEMTRIS Global Architecture 
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Data Storage Principles 



Data will be stored between 6 months and up to 3 years 
(if following EU framework). Period varies depending 
upon predetermined ‘value’ of data. 

Data is IRI+ for DR and IRI+CC for LI. 

Data captured and stored will have varying value, from 
PI to much lower priorities. 

Storing principles must allow effective mining. 

Anticipate large volumes of data, much of this ‘low 
value’. 

But, some ‘low value’ data may become ‘interesting’ 
later- Must be able to retrieve and raise priority. 
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Data Flow Principles 1 



LEAs do need ALL high priority data. This may 
include: 

■ LI related material 

■ Associates of people under active LI 

■ People on ‘high interest’ list. 

This data is used for high priority Agency actions 
and Agency analysis. 

This is expected to be a low % of total available 
data. 
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Data Flow Principles 2 



Majority of stored data, all DR related, is for: 

General analysis looking for ‘fits’ against defined 
criminal profiles. 

Held for potential later use if ‘new’ areas or 
people of interest are identified. 

This data is available to LEAs but doesn’t drive 
day-to-day high priority activities. 
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Action and Analysis -Principles 1 

LEA Treasure Chest: 

■ Known people and/or services 

■ Understanding of Criminal Actions (Profiles) 

LEA Stored Data for Analysis/Action 

■ LI- High Priority (PI) 

■ Target IRI- High Priority (P2) 

■ DR High Value Material- Medium Priority (P3) 

This material drives direct LEA action and is used 
for detailed profile analysis. 

Material is stored using easy/quick access principles. 
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Action and Analysis- Principles 2 

Stored Data at CSP/ISP: 

All data is DR related 

Data is classified ‘Low Value’, Priority P4 and P5 

Due to high volumes, Data is stored using ‘economic’ 
principles that allow data to be mined but with much lower 
urgency. 

LEA Actions: 

Active analysis using broad profile testing mechanism. 
Action- Filter data to assess if a combination of events 
have occurred. 

LEAs provided with Alarm/Report if a profile match 
occurs. 

Profile is managed /tuned by LEAs 
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An Integrated LI/DR Solution 



Summary: 

An integrated LI/DR solution is achievable and provides 
multiple benefits. 

LI and DR analysis together has the potential to provide 
a powerful analysis capability. 

Need an effective end-to-end data capture and store 
capability. 

A System that balances storage between LEA and CSP 
can optimize costs and maintain operational flexibility 

Need Flexible Architecture. 

Establish a Good, Flexible Mining capability. 

• Use Profiling 

Effective, flexible Analysis tools. 
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It Can Work- Some References ... 
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Thank You 




AQSAC 0 M Americas 
New York, US 
Tel: +1 202 315 3943 



AQSACOM Europe AQSACOM Asia-Pacific 

Paris, France Melbourne, Australia 

Tel: +33 1 69 29 84 00 Tel: +61 3 99 09 72 80 

Email: sales@aqsacom.com 



AQSACOM Middle East 
Dubai, UAE 
Tel: +971 44 35 58 30 
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